EL 2.1 FW 1.11.1 Modbus TCP Communication Interface

• Introduction
• Physical Interface Connection
• TCP/IP Connection Settings
• Modbus Connection Settings
• References
• Data Formats Used
• Data Bits/Registers Dimension
• Data Encoding
• Implemented Modbus Functions
• Modbus Data Model
• Set/Read Modbus IP
• Modbus Table
• Diagrams
• Examples

Introduction

Refer to the Reference section for details of the Modbus protocol.

This document describes public Modbus TCP implementation for Enapter Electrolyser EL 2.1 and assume understanding of TCP/IP and Modbus protocols.

Physical Interface Connection

Connect Ethernet cable to the Ethernet Port of Enapter EL 2.1 electrolyser.

TCP/IP Connection Settings

By default DHCP client is enabled therefore IP address will be assigned automatically by DHCP server available in the connected network.

It is recommended to set DHCP reservation based on MAC address of the electrolyser.

Configuration of the Static IP is possible using Enapter Cloud and Enapter Mobile Application for iOS and Android.

Modbus Connection Settings

Option	Value	Comment
Modbus Port	502
Modbus Slave Address	1	Enapter Electrolyser always addressed as a slave

References

http://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b.pdf (opens new window)

Data Formats Used

Primary tables	Object Type	Permission	Comment
Input Registers	16 bit word	Read Only
Holding Registers	16 bit word	Read / Write

Data Bits/Registers Dimension

Data Type	Size in Bits	Registers Used	Comment
Boolean	16 bits	1 register	0 value means 'false', all other cases - 'true'
Uint16	16 bits	1 register
Uint32	32 bits	2 registers
Uint64	64 bits	4 registers
Float32	32 bits: * bit 31: Sign (1 bit) * bit 30-23: Exponent (8 bits) * bit 22-0: Fraction (23 bits)	2 registers	IEEE 754 Single-precision floating-point

Data Encoding

Big-endian, high word first data encoding used.

This means that when more than single byte (8 bits) is transmitted, network byte order is used - the most significant byte placed at lower address (sent first).

Implemented Modbus Functions

Function	Code	Comment
Read Holding Registers	03
Read Input Registers	04
Write Single Holding Register	06
Write Multiple Holding Registers	16

Modbus Data Model

Input registers and Holding registers are referred to in the range 3XXXX and 4XXXX respectful (also known as PLC Address). For example, Holding register 0 in this document would be referred to as 40001 and would be addressed as register 0000 in the data address field of the Modbus message (also known as Protocol Address).

Set/Read Modbus IP

To set Modbus IP:

1. Open the Cloud and navigate to your site
2. Select EL2.1 you want to set Modbus IP
3. Click the Configuration menu item
4. Click Set Modbus IP
5. Enter the IP address and then click Create Command
6. Wait until command will be accepted

To read Modbus IP:

1. Open the Cloud and navigate to your site
2. Select EL2.1 you want to read Modbus IP
3. Click the Configuration menu item
4. Click Read Modbus IP
5. You can see Modbus IP in Execution Payload section

Modbus Table

Holding Registers (Read / Write)

Register	Data Type	Name	Comment
0	Uint64	Unix Time	Seconds from 1 January 1970 UTC. e.g. 02/29/2020 @ 3:15 PM (UTC) represented as 1582989315.
4	Boolean	Reboot	1 = Reboot.
5	Boolean	Locate Electrolyser	1 = Start Blinking All LED; 0 = Stop Blinking All LED.
6	Boolean	System Maintenance Mode	1 = Enable Maintenance Mode; 0 = Disable Maintenance Mode.
1000	Boolean	Start / Stop Electrolyser	1 = Start; 0 = Stop.
1002	Float32	Production Rate [%]	Current production rate in percent (system reset set this value to 'Default Production Rate'), can be changed 'on-fly' even when electrolyser produce H2
1010	Boolean	Request Blowdown routine	1 = Request blowdown or read 'is blowdown requested'
1011	Boolean	Force Water Refilling	1 = Start Force Water Refilling
1013	Boolean	Maintenance Mode	1 = Enable Maintenance Mode; 0 = Disable Maintenance Mode.
1014	Boolean	Preheat	1 = Start Preheat
4000	Boolean	Configuration Begin	1 = Start configuration
4001	Boolean	Configuration Commit	1 = Commit current changes; 0 = Rollback changes
4020	Uint32	Set Ethernet IP Address	e.g. 0xC0A80201 (192.168.2.1); 0 = DHCP enabled
4022	Uint32	Set Ethernet IP Netmask	Ex: 255.255.255.0
4024	Uint32	Set Ethernet Gateway IP Address	Ex: 192.168.2.1
4038	Int32	Cloud logs	0 = disable logging (default); 1 = only fatal errors; 2 = fatal errors and errors; 3 = warnings and more important; 4 = everything before and important messages; 5 = all messages, except internal debug ones; 6 = all messages
4042	Int32	System logs	0 = disable logging (default); 1 = only fatal errors; 2 = fatal errors and errors; 3 = warnings and more important; 4 = everything before and important messages; 5 = all messages, except internal debug ones; 6 = all messages
4044	Uint32	Syslog IP Address	Default IP address 255.255.255.255 (Broadcast)
4046	Uint16	Syslog Port	Default port 514
4142	Float32	Chassis Altitude	[m]
4308	Float32	Set Max Tank Pressure (Outlet)	[bar]
4310	Float32	Set Restart Pressure (Outlet)	[bar]
4396	Float32	Set Default Production Rate [%]	This register can be modified only when stack is inactive (Idle or Maintenance mode)
4600	Uint32	Heartbeat ModBus Timeout	[Seconds]; 0 = disable
4602	Uint32	Heartbeat Gateway Timeout	[Seconds]; 0 = disable
4604	Uint32	Heartbeat UCM Timeout	[Seconds]; 0 = disable
6014	Float32	PT01 minimal threshold	Dryer output pressure at which it leaves Stand-by. Updated value is saved only after writing 1 to register #6022.
6016	Float32	PT01 maximal threshold	Dryer output pressure at which it moves to Stand-by. Updated value is saved only after writing 1 to register #6022.
6018	Boolean	Start/Stop Dryer	Write: 1 = Start; 0 = Stop. Read register #6021 to check Dryer Logic States. Avoid frequent write operations, since it can damage Dryer's Flash.
6019	Uint16	Stop Dryer	DEPRECATED
6020	Uint16	Reboot Dryer	Write: 1 = Reboot Dryer; Read = number of times Dryer was rebooted. Avoid frequent write operations, since it can damage Dryer's Flash.
6022	Uint16	Save updated Dryer configuration	Write: 1 = Save updated Dryer configuration on flash. Avoid frequent write operations, since it can damage Dryer's Flash.
6023	Uint16	Locate Dryer in DCN/IDCN	0 = Disable; 1 = Enable
6024	Uint16	Reboot UCM	1 = Reboot UCM
6200	Uint32	Water Tank status	Read Water Tank States (bitmask)
6202	Float32	Water Tank water level	[Liters]
6204	Float32	Water Tank inlet temperature	[°C]
6206	Float32	Water Tank tank temperature	[°C]
6208	Float32	Water Tank conductivity	[μS/cm]
6210	Float32	Water Tank pump current	[Amperes]
6212	Uint32	Reserved	Reserved for WT21
6214	Uint32	Reserved	Reserved for WT21
6216	Uint32	Reserved	Reserved for WT21
6218	Uint32	Reserved	Reserved for WT21
6220	Uint32	Water Tank UCM uptime	[Seconds]
6222	Uint16	Command to Water Tank	Write: 1 = Start; 2 = Stop; 3 = Reboot WT control board; 4 = Reboot WT UCM board; 5 = Locate OFF; 6 = Locate ON; 7 = Maintenance OFF; 8 = Maintenance ON
6223	Uint16	Reserved	Reserved for WT21
7005	Boolean	Cooling valve V106	0 = Close; 1 = Open

Input Registers (Read Only)

Register	Data Type	Name	Comment
0	Uint32	Device Model	0x454C3231 for EL 2.1
2	Uint16	Firmware MAJOR and MINOR Version	Ex: 769 => 769 // 256 = 3, 769 % 256 => 1 (3.1)
3	Uint16	Firmware PATCH Version	Ex: 3 => 3 (3)
4	Uint32	Firmware Build Number	Ex: 0x4E343471
6	Uint128	Device Control Board Serial Number	Ex: 9E25E695-A66A-61DD-6570-50DB4E73652D
14	Uint64	Chassis Serial Number	1 bits - reserved, must be 0 10 bits - Product Unicode 11 bits - Year + Month 5 bits - Day 24 bits - Chassis Number 5 bits - Order 8 bits - Site Example
18	Uint16	System State	0 = Internal Error, System not Initialized yet; 1 = System in Operation; 2 = Error; 3 = Fatal Error; 4 = System in Expert Mode.
20	Uint32	Live time [seconds]	Total time during which a system is power up (not only time when stack is working).
22	Uint32	Uptime [seconds]	How long the system has been running
768	Array of 32 Warning Events	Warning Events Array	Warning Events Array represented by Error Codes. First Uint16 contains total quantity of Warning Events.
832	Array of 32 Error Events	Error Events Array	Error Events Array represented by Error Codes. First Uint16 contains total quantity of Error Events.
1000	Uint32	Product Code	0x00 = ELE210535A2AXV01_03 0x01 = ELE210508A2AXV01_03 0x02 = ELE210535A2AXV04 0x03 = ELE210508A2AXV04 0x04 = ELE210535A2LSV01 0x05 = ELE210508A2LXV01 0x06 = ELE210535D4AXV01 0x07 = ELE210508D4AXV01 0x08 = ELE210535A2ASV05 0x09 = ELE210508A2ASV05 0x0A = ELE210535A2ASV06 0x0B = ELE210508A2ASV06 0x0C = ELE210535A2ASV07 0x0D = ELE210508A2ASV07 0x0E = ELE210535A2LSV02 0x0F = ELE210508A2LSV02 0x10 = ELE210535A2LSV03 0x11 = ELE210508A2LSV03 0x12 = ELE210535A2ASV08 0x13 = ELE210508A2ASV08 0x14 = ELE210535A2LSV04 0x15 = ELE210508A2LSV04 0x16 = ELE210535A2ASV09 0x17 = ELE210508A2ASV09 0x18 = ELE210535A2LSV05 0x19 = ELE210508A2LSV05 0x1A = ELE210535D4ANV02 0x1C = ELE210535A2ASV10 0x1D = ELE210508A2ASV10 0x1E = ELE210535A2LSV06 0x1F = ELE210508A2LSV06 0x20 = ELE210535A2ASV11 0x21 = ELE210508A2ASV11 0x22 = ELE210535A2LSV07 0x23 = ELE210508A2LSV07 0x24 = ELE210535A2ASV12 0x25 = ELE210508A2ASV12 0x26 = ELE210535A2LSV08 0x27 = ELE210508A2LSV08 0x30 = ELE210535A2ASV13 0x31 = ELE210508A2ASV13 0x32 = ELE210535A2LSV09 0x33 = ELE210508A2LSV09 0x36 = ELE210535D4ANV03 0x37 = ELE210535D4ANV04
1002	Uint32	Stack Start/Stop Cycles Quantity	How many Stack Start/Stop cycles
1004	Uint32	Stack Total Runtime	seconds
1006	Float32	Stack Total H2 Production	NL
1008	Float32	H2 Flow Rate	NL/hour, NAN when not producing H2;
1010	Uint64	Stack Serial Number	1 bits - reserved, must be 0 15 bits - Stack Type 11 bits - Year + Month 5 bits - Day 24 bits - Stack Number 8 bits - Site
1200	Uint16	Electrolyser State	0 = Halted; 1 = Maintenance mode; 2 = Idle; 3 = Steady; 4 = Stand-By (Max Pressure); 5 = Curve; 6 = Blowdown.
4000	Boolean	Configuration Progress	1 = Configuration is in progress.
4001	Boolean	Configuration Source	1 = Configuration over Modbus.
4002	Int32	Last Configuration Result	0 = OK, Configuration was completed successfully; 1 = Permanent, The operation has failed (internal or general error); 2 = No Entry, Configuration was not started or interrupted; 5 = I/O, Data save error; 11 - Try again, Configuration needs to be tried again; 13 = Access Denied, Some changed registers are read-only; 16 = Busy, Another configuration was in progress; 22 = Invalid, The data has invalid or wrong type.
4004	Uint16	Last Configuration Wrong Holding	Keeps first invalid Holding register number which doesn't allow successful configuration commit.
4600	Uint16	Heartbeat	Timeout for Modbus Heartbeat in seconds. 0 = disabled (default)
6000	Uint16	Dryer Error	Dryer error code (bitmask).
6001	Uint16	Dryer Warning	Dryer warning code (bitmask).
6002	Float32	Dryer TT00	Temperature of heater element for cartridge 0 (first line).
6004	Float32	Dryer TT01	Temperature of heater element for cartridge 1 (second line).
6006	Float32	Dryer TT02	Temperature of heater element for cartridge 2 (first line).
6008	Float32	Dryer TT03	Temperature of heater element for cartridge 3 (second line).
6010	Float32	Dryer PT00	Input pressure of the dryer.
6012	Float32	Dryer PT01	Output pressure of the dryer.
6021	Uint16	Dryer state	Read Dryer Logic States
7000	Boolean	High Electrolyte Level Switch (LSH102B_in)	1 = Electrolyte level over sensor; 0 = Electrolyte level below sensor.
7001	Boolean	Very High Electrolyte Level Switch (LSHH102A_in)	1 = Electrolyte level over sensor; 0 = Electrolyte level below sensor.
7002	Boolean	Low Electrolyte Level Switch (LSL102D_in)	1 = Electrolyte level over sensor; 0 = Electrolyte level below sensor.
7003	Boolean	Medium Electrolyte Level Switch (LSM102C_in)	1 = Electrolyte level over sensor; 0 = Electrolyte level below sensor.
7004	Boolean	Electrolyte Tank High Pressure Switch (PSH102_in)	1 = Pressure is too high; 0 = Pressure is normal.
7005	Boolean	Very High Hydrogen Pressure Switch (PSHH101B_in)	1 = Pressure is too high; 0 = Pressure is normal. Works only for Electrolysers with the following product codes: ELE210535A2AXV04, ELE210508A2AXV04, ELE210535A2LSV01, ELE210508A2LXV01, ELE210535D4AXV01, ELE210508D4AXV01, ELE210535A2ASV05, ELE210508A2ASV05, ELE210535A2ASV06, ELE210508A2ASV06.
7006	Boolean	Downstream High Temperature Switch (TSH106_in)	1 = Temperature is too high. 0 = Temperature is normal.
7007	Boolean	Electronic Compartment High Temperature Switch (TSH108_in)	1 = Temperature is too high. 0 = Temperature is normal.
7008	Boolean	Very Low Electrolyte Temperature Switch (TSLL102B_in)	1 = Temperature is too low. 0 = Temperature is normal.
7009	Boolean	Chassis Water Presence Switch (WPS104_in)	1 = Water is present on input; 0 = No water input.
7010	Boolean	Dry Contact	1 = OK (Closed); 0 = NOT OK (Opened)
7500	Float32	Electrolyte Cooler Fan Speed (F103A_in_rpm)	[rpm]
7502	Float32	Air Circulation Fan Speed (F104B_in_rpm)	[rpm]
7504	Float32	Electronic Compartment Cooling Fan Speed (F108C_in_rpm)	[rpm]
7506	Float32	Electrolyte Flow Meter (FM106_in_lmin)	[Liters per minute]
7508	Float32	Stack Current (HASS_in_a)	[Ampere]
7510	Float32	PSU Voltage (Stack Voltage) (PSU_in_v)	[Volt]
7512	Float32	Inner Hydrogen Pressure (PT101A_in_bar)	[bar]
7514	Float32	Outer Hydrogen Pressure (PT101C_in_bar)	[bar]
7516	Float32	Water Inlet Pressure (PT105_in_bar)	[bar]
7518	Float32	Electrolyte Temperature (TT102A_in_c)	[°C]
7520	Float32	Downstream Temperature (TT106_in_c)	[°C]
8000	Float32	Inner Hydrogen Pressure Raw Sensor Value (PT101A_in_v)	Raw value, [Volt]
8002	Float32	Outer Hydrogen Pressure Raw Sensor Value (PT101C_in_v)	Raw value, [Volt]
8004	Float32	Stack Current Raw Sensor Value (HASS_in_v)	Raw value, [Volt]

Dryer error/warning code bitmask

Dryer error/warning code bitmask (opens new window) is 16-bit value where each bit representing one type of error. The following table provides the detailed description of each error.

Bit number	Description
0	TT00 has invalid value (sensor provides unexpected values)
1	TT01 has invalid value (sensor provides unexpected values)
2	TT02 has invalid value (sensor provides unexpected values)
3	TT03 has invalid value (sensor provides unexpected values)
4	TT00 value growth is not enough (heating mechanism does not work properly)
5	TT01 value growth is not enough (heating mechanism does not work properly)
6	TT02 value growth is not enough (heating mechanism does not work properly)
7	TT03 value growth is not enough (heating mechanism does not work properly)
8	PS00 (pressure switch on line 0) is triggered
9	PS01 (pressure switch on line 1) is triggered
10	F100 has invalid RPM speed (fan between line 0 and line 1)
11	F101 has invalid RPM speed (fan on line 0)
12	F102 has invalid RPM speed (fan on line 1)
13	PT00 (Input pressure) has invalid value (sensor provides unexpected values)
14	PT01 (Output pressure) has invalid value (sensor provides unexpected values)

Water Tank States (bitmask)

Water Tank status bitmask (opens new window) is 32-bit value where bit representing one type of status. The following table provides the detailed description of each state.

Bit number	State Name
0	N/A
1	Stop
2	Maintenance
4	Bad quality water input
5	Waiting for water
6	High water inlet temperature
7	Low water inlet temperature
8	Very low water level
9	Low water level
10	Very high water level (warning)
12	Low water tank temperature
14	Very high water level (fatal error)
15	Tank refilling issue
16	Tank temperature sensor broken
17	Inlet temperature sensor broken
18	Water level sensor broken
20	Current sensor broken
21	Water leak
22	Valve leak
23	Pump broken
25	Factory settings reset failed
26	Internal error

Diagrams

System State Diagram

This diagram describes possible transition between different electrolyser states. The state can be read in the Input Register #18.

Examples

Example: Reading Chassis Serial Number

Read from Modbus 586601960808264448.

Decode into binary format 0001000001 00100000001 11011 000000001101010000110001 10011 00000000 and parse every part.

Product Unicode = 0b0001000001 = 65 => 'AB'

65 % 32 = 1 => A (A=1, B=2,..., Z=26 => 'A')

65 // 32 = 2 => B (A=1, B=2,..., Z=26 => 'B')

Year + Month = 0b00100000001 = 257 => 21 05

257 // 12 = 21 => 21 (Year)

257 % 12 = 5 => 05 (May)

Day = 0b11011 = 27

Chassis Number = 0b000000001101010000110001 = 54321

Order = 0b10011 = 19: (=>S)

Site = 0b000000 = 0 => PI (0 - PIsa, 1 - SAerbeck)

Result Chassis Serial Number - AB 21 05 27 54321 S PI

Example: Change Electrolyser Restart Pressure over Modbus TCP

Here is an example to change Electrolyser Restart Pressure to 25 bar over Modbus TCP. This will enable Electrolyser to restart when pressure drop to 25 bar on outlet.

Example: Reading Modbus Input Registers

• Request Packet

  Transaction ID	Protocol ID	Query Length	Unit ID	Function Code	Reference Number	Word Count
  00 01	00 00	00 06	01	04	03 EE	00 02

• Request Packet Description

  Modbus/TCP

  • Transaction ID – default: 00 01
  • Protocol ID – default: 00 00
  • Query Length – default: 00 06
  • Unit ID: Slave Address – default: 01

  Modbus

  • Function Code: Read Input Registers – default: 04
  • Reference Number: Starting register – decimal: 1006
  • Word Count: Number of registers to read – decimal: 2

• Wireshark Example

• Response Packet

  Transaction ID	Protocol ID	Query Length	Unit ID	Function Code	Byte Count	Register[0]	Register[1]
  00 01	00 00	00 07	01	04	04	48 00	10 7A

• Response Packet Description

  Modbus/TCP

  • Transaction ID – default: 00 01
  • Protocol ID – default: 00 00
  • Query Length – decimal: 7
  • Unit ID: Slave Address – default: 01

  Modbus

  • Function Code: Read Input Registers – default: 04
  • Byte Count: Registers values size – decimal: 4
  • Register[0] value – decimal: 18432
  • Register[1] value – decimal: 4218
  • Register[…] value – 2 bytes

• Wireshark Example

Example: Writing to Modbus Holding Registers

• Request Packet

  Transaction ID	Protocol ID	Query Length	Unit ID	Function Code	Reference Number	Data
  00 01	00 00	00 06	01	06	00 04	00 01

• Request Packet Description

  Modbus/TCP

  • Transaction ID – default: 00 01
  • Protocol ID – default: 00 00
  • Query Length – default: 00 06
  • Unit ID: Slave Address – default: 01

  Modbus

  • Function Code: Write Single Register – default: 06
  • Reference Number: Starting register – decimal: 4
  • Data: Value to write – decimal: 1

• Wireshark Example

• Response Packet

  Transaction ID	Protocol ID	Query Length	Unit ID	Function Code	Reference Number	Data
  00 01	00 00	00 06	01	06	00 04	01

• Response Packet Description

  Modbus/TCP

  • Transaction ID – default: 00 01
  • Protocol ID – default: 00 00
  • Query Length – default: 00 06
  • Unit ID: Slave Address – default: 01

  Modbus

  • Function Code: Write Single Register – default: 06
  • Reference Number: Register to write – decimal: 4
  • Data: Value to write – decimal: 1

• Wireshark Example

Example: Reading Errors Sequence

• Request Packet

  Transaction ID	Protocol ID	Query Length	Unit ID	Function Code	Reference Number	Word Count
  00 01	00 00	00 06	01	04	03 40	00 20

• Request packet description

  Modbus/TCP

  • Transaction ID – default: 00 01
  • Protocol Identifier – default: 00 00
  • Query Length – default: 00 06
  • Unit ID: Slave Address – default: 01

  Modbus

  • Function Code: Read Input Registers – default: 04
  • Reference Number: Starting register – default: 03 40
  • Word Count: Number of registers to read – default: 00 20

• Wireshark Example

• Response Packet

  Transaction ID	Protocol ID	Query Length	Unit ID	Function Code	Byte Count	Register[0]	Register[1]
  00 01	00 00	00 43	01	04	40	00 01	11 B3

• Response packet description

  Modbus/TCP

  • Transaction ID – default: 00 01
  • Protocol ID – default: 00 00
  • Query Length – default: 00 43
  • Unit ID: Slave Address – default: 01

  Modbus

  • Function Code: Read Input Registers – default: 04
  • Byte count: Registers values size – default: 40
  • Register[0] value – total number of errors, decimal: 1
  • Register[1] value – error code 1: 11 B3
  • Register[…] value – error code N

• Wireshark Example

Example: Writing Heartbeat Modbus Timeout

• Request Packet

  Transaction ID	Protocol ID	Query Length	Unit ID	Function Code	Reference Number	Data
  00 02	00 00	00 06	01	06	0F A0	00 01

• Request Packet Description

  Modbus/TCP

  • Transaction ID – decimal: 2
  • Protocol ID – default: 00 00
  • Query Length – default: 00 06
  • Unit ID: Slave Address – default: 01

  Modbus

  • Function Code: Write Single Register – default: 06
  • Reference Number: Starting register – decimal: 4000
  • Data: Value to write – decimal: 1

• Wireshark Example

• Response Packet

  Transaction ID	Protocol ID	Query Length	Unit ID	Function Code	Reference Number	Data
  00 02	00 00	00 06	01	06	0F A0	00 01

• Response Packet Description

  Modbus/TCP

  • Transaction ID – decimal: 2
  • Protocol ID – default: 00 00
  • Query Length – default: 00 06
  • Unit ID: Slave Address – default: 01

  Modbus

  • Function Code: Write Single Register – default: 06
  • Reference Number: Register to write – decimal: 4000
  • Data: Value to write – decimal: 1

• Wireshark Example

• Request Packet

  Transaction ID	Protocol ID	Query Length	Unit ID	Function Code	Reference Number	Data
  00 03	00 00	00 06	01	06	11 F8	00 00

• Request Packet Description

  Modbus/TCP

  • Transaction ID – decimal: 3
  • Protocol ID – default: 00 00
  • Query Length – default: 00 06
  • Unit ID: Slave Address – default: 01

  Modbus

  • Function Code: Write Single Register – default: 06
  • Reference Number: Starting register – decimal: 4600
  • Data: Value to write – decimal: 0

• Wireshark Example

• Response Packet

  Transaction ID	Protocol ID	Query Length	Unit ID	Function Code	Reference Number	Data
  00 03	00 00	00 06	01	06	11 F8	00 00

• Response Packet Description

  Modbus/TCP

  • Transaction ID – decimal: 3
  • Protocol ID – default: 00 00
  • Query Length – default: 00 06
  • Unit ID: Slave Address – default: 01

  Modbus

  • Function Code: Write Single Register – default: 06
  • Reference Number: Register to write – decimal: 4600
  • Data: Value to write – decimal: 0

• Wireshark Example

• Request Packet

  Transaction ID	Protocol ID	Query Length	Unit ID	Function Code	Reference Number	Data
  00 04	00 00	00 06	01	06	0F A1	00 01

• Request Packet Description

  Modbus/TCP

  • Transaction ID – decimal: 4
  • Protocol ID – default: 00 00
  • Query Length – default: 00 06
  • Unit ID: Slave Address – default: 01

  Modbus

  • Function Code: Write Single Register – default: 06
  • Reference Number: Starting register – decimal: 4001
  • Data: Value to write – decimal: 1

• Wireshark Example

• Response Packet

  Transaction ID	Protocol ID	Query Length	Unit ID	Function Code	Reference Number	Data
  00 04	00 00	00 06	01	06	0F A1	00 01

• Response Packet Description

  Modbus/TCP

  • Transaction ID – decimal: 4
  • Protocol ID – default: 00 00
  • Query Length – default: 00 06
  • Unit ID: Slave Address – default: 01

  Modbus

  • Function Code: Write Single Register – default: 06
  • Reference Number: Register to write – decimal: 4001
  • Data: Value to write – decimal: 1